RISK APPETITE & TOLERANCE: THE NEW GLOBAL IMPERATIVE

58 Pages·2013·2.19 MB·English

by  W. Hersh

BOARD OVERSIGHT OF MANAGEMENT’S
RISK APPETITE & TOLERANCE:
THE NEW GLOBAL IMPERATIVE
TIM LEECH, FCPA, CIA, CRMA, CCSA, CFE
MANAGING DIRECTOR GLOBAL SERVICES
RISK OVERSIGHT INC.
SPONSORED BY: BPS RESOLVER
March 27, 2013
Your Presenter
Tim Leech
Managing Director Global Services
Risk Oversight Inc.
www.riskoversight.ca
[email protected]
2
About Your Presenter
Tim J. Leech, FCPA CIA CRMA CCSA CFE is Managing Director Global Services at Risk Oversight Inc. (“RO”)
He has over 30 years of experience in the ERM, internal audit, IT, and forensic accounting fields. His
experience base includes setting up a new business unit for Coopers & Lybrand, Control & Risk
Management Services, in 1987; founding, building, and successfully selling CARD®decisions, a global risk
and assurance consulting and software firm, to Paisley/Thomson Reuters from 1991 to 2004; serving as
Paisley’s Chief Methodology Officer from 2004 -2007; and global experience helping clients with internal
audit transformation initiatives and the design, implementation, and maintenance of integrated GRC/ERM
methodology and technology frameworks. He developed and successfully released CARD®map, the world’s
first integrated risk and assurance software, in 1997. The web-enabled “cloud” version of CARD®map
was released in 2000. He has delivered IIA IPPF Standard 2120 training on how to assess and report on the
effectiveness of risk management processes to internal auditors and risk specialists in locations around the
world. He is the author of the December 2012 Conference Board Director Notes publication “Board
Oversight of Management’s Risk Appetite and Tolerance” and the globally acknowledged RO white paper
“The High Cost of ERM Herd Mentality”. Risk Oversight Inc. and BPS Resolver will be launching
RiskStatusNet™ - “next generation” ERM/GRC software in mid 2013. In 1997 Leech was awarded the
designation Fellow of the Ontario Institute of Chartered Accountants (FCPA/FCA) in recognition of his
public service and contributions in the fields of risk and control management. In September 2009 Tim was
awarded the first ever IIA Canada Outstanding Contributor to the Profession of Internal Auditing award in
recognition of over 25 years of global service to the internal audit profession.
3
Agenda
• Evolution of risk oversight expectations
• ERM scorecard to date
• Traditional “Supply Driven” IA & ERM - What’s wrong with the
status quo?
• Why Change your IA/ERM approach?
• Board Driven/Objective-centric (“BD/OC”) IA & ERM
• BD/OC IA & ERM – Step by Step
• Business case for BD/OC IA & ERM
• BD/OC - Next Generation Risk & Assurance Technology
• Questions
4
Evolution of Risk Oversight Expectations
5
Evolution of Risk Oversight Expectations
6
Evolution of Risk Oversight Expectations
Senior Supervisors
Group issued three
important reports:
1. March 6, 2008 “Observations on
Risk Management Practices
during the Recent Market
Turbulence”
2. October 21, 2009 “Risk
Management Lessons from the
Global Banking Crisis of 2008”
3. December 23, 2010
“Observations on Developments
in Risk Appetite Frameworks and
IT Infrastructure”
http://www.newyorkfed.org/newsevents/news/banking/2008/SSG_Risk_Mgt_doc_final.pdf
http://www.newyorkfed.org/newsevents/news_archive/banking/2009/SSG_report.pdf
http://www.newyorkfed.org/newsevents/news/banking/2010/an101223.pdf
7
Evolution of Risk Oversight Expectations
8
Evolution of Risk Oversight Expectations
NACD Board Risk Oversight Criteria
While risk oversight objectives may vary from company to
company, every board should be certain that:
• the risk appetite implicit in the company’s business model,
strategy, and execution is appropriate.
• the expected risks are commensurate with the expected
rewards.
• management has implemented a system to manage, monitor,
and mitigate risk, and that system is appropriate given the
company’s business model and strategy.
9
Evolution of Risk Oversight Expectations
While risk oversight objectives may vary from company to
company, every board should be certain that:
• The risk management system informs the board of the major
risks facing the company.
• An appropriate culture of risk-awareness exists throughout
the organization.
• There is recognition that management of risk is essential to
the successful execution of the company’s strategy.
Source: National Association of Corporate Directors, REPORT OF THE NACD BLUE RIBBON
COMMISSION, RISK GOVERNANCE: BALANCING RISK AND REWARD, October 2009
10